Partial stroke testing system coupled with fuel control valve

ABSTRACT

A system for on-line testing of an emergency shut-off valve includes a first emergency shut-off valve (first valve) and a flow control valve (second valve), with the system being configured to allow the second valve to serve as a combination flow control and second emergency shut-off valve. A subsystem is also provided for testing the first valve without fully closing the first valve in response to a signal from the control. In this subsystem, a solenoid valve bleeds off pressurized fluid to move the first valve from a fully opened to a partially closed position. A bypass around the second valve allows it to be tested as the second emergency shut-off valve, allowing the second valve to close completely without shutting down the process. The use of the two emergency shut-off valves in series wherein either valve can shut down the process provides a level 3 safety integrity level.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation-in-part of U.S. patent applicationSer. No. 12/038,830, filed on Feb. 28, 2008.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates to a system for improving the Safety IntegrityLevel (SIL) rating of process heaters (e.g., industrial heating systems)using partial stroke testing of an emergency shut-off valve coupled to asupplementary fuel control valve.

2. Description of the Related Art

In the oil, gas, petroleum and power industries, natural gas or othercombustible gas is often used to provide the required heat or combustionmotive power for the desired operation, more generally referred toherein as a “process.” Various conditions may occur that necessitateimmediate shut down or tripping of the operations, process or plant. Inthose industries, a majority of the final control elements of a shut-offsystem are implemented with fast acting shut-off valves. In suchindustries, a majority of the shut-off valves remain open while theprocess is in a safe and controlled state. Such valves are closed onlyupon a plant trip, i.e., actuation of the shutdown system of the plant,arising from an out-of-control process or during a normal maintenanceoutage.

In practice, the testing of emergency shut-off valves is normally doneduring shut down of the process or plant operation. However, there is atendency for such valves to stick or freeze due to corrosion or otherreasons, which may lead to an unsafe condition where the valve cannot beclosed during an emergency shutdown. This problem is exacerbated byeconomic conditions in the operation of the factory or plant that havelead to a reduction in the frequency of valve shut-offs for maintenanceor testing purposes. For example, in some operations a process oroperation may run continuously for one or more years without shuttingdown the process for maintenance.

State of the art emergency shut-off systems, which control the shut-offvalves, have a number of features to detect plant or process failuresand typically include redundancies for added reliability. However, suchsystems may not provide for the testing of a shut-off valve itself otherthan stroking the valve. The problem is that full stroking or completelyclosing the valve causes an undesirable disruption in the process.

A number of patents have been issued in the past that relate to theoperation or stroking of industrial valves, and the increase ofreliability in such systems. An example of such is found in U.S. Pat.No. 6,155,282, issued to Zachary et al., which discloses an arrangementfor testing solenoids individually without process interruption. Thearrangement operates in a two out of three manner to provide relativelyhigh safety, low spurious tripping and a relatively low installationcost, while also enabling on-line testing of each solenoid individuallywithout process interruption. Solenoid arrangements are preferablymanifolded to facilitate maintenance on any detected failure, and tosimplify installation and replacement.

A more recent U.S. Pat. No. 6,920,409, issued to Essam, discloses anapparatus for testing the operation of an emergency valve. As disclosed,the apparatus is for testing an emergency valve in which a valve memberis moveable by a fluid operated actuator between a normally open orclosed position and an emergency position, closed or open respectively.The apparatus comprises partial stroking means for the valve includingmeans for initiating emergency movement of the valve from its normalposition towards its emergency position, and means for returning it froma predetermined position intermediate the normal and emergency positionsat its normal operating speed. The apparatus includes means fordetecting the loss of the controlling electrical signal to the valve anda means for detecting the correct operation of the valve and itsassociated operating components by measuring the pressure of fluid beingreleased from or being applied to the actuator.

In addition, U.S. Pat. No. 7,010,450, issued to Law et al., discloses acombination of field device operations with overrides and bypasseswithin a process control and safety system. The process control orsafety instrumented system uses function block logic to coordinate thelogic within the process control or safety instrumented system withoperational states of field devices, even when these operational statesare initiated externally to the process control or safety system. Logicwithin input or voter function blocks associated with field devices maymonitor and determine when the associated field devices are being putinto testing or calibration modes and may automatically initiateappropriate bypass or override functionality in response to suchdetected field device configuration states. Likewise, the function blocklogic may automatically remove the bypass or override functionality whenthe field devices are placed back into their normal operationalconfiguration states. This automatic initiation of bypasses andoverrides helps to prevent a safety system within a process plant frominitiating a shut-down procedure as a result of a device test initiatedmanually by, for example, a handheld device attached to a field device.Likewise, the automatic removal of bypasses and overrides helps toprevent a safety system within a process plant from failing to operateproperly because a user forgot to manually reset a bypass or overridethat was set up to allow a device test.

Recognizing that the emergency shut-off valves can be stroked oroperated through the partial length or movement of their full travel asa safeguard against frozen or stuck valves has lead to a need for asimple, secure and reliable system for testing such valves withoutadversely affecting production. This approach also improves the safetyof the operation.

The partial stroke testing system in accordance with my earlierinvention, described in my U.S. Pat. No. 6,435,022, which is herebyincorporated by reference in its entirety, provides a low cost, simpleand reliable test for emergency shut-off valves in the oil, gas,petrochemical and power industries. Such tests do not adverselyinterrupt the plant or factory operation or process and will minimize oralmost eliminate the risk of a “frozen” emergency shutoff valve in theevent of an out-of-control process or operation. Such a system is costeffective and has been designed to utilize a shut-off valve with a fastacting piston actuator. The system is also applicable to slow actingvalves.

In processes in the oil, gas, petroleum, and power industries, fuel topower the heaters, boilers, or the like, or perhaps to provide fuel fora prime mover, is fed to the associated burners or other componentsthrough a fuel control valve and a fuel shut-off valve. The fuel controlvalve regulates pressure/flow to the burners, whereas the shut-off valveis normally in a fully open state. The shut-off valve closes to cut offfuel supply in the event of an emergency.

SUMMARY OF THE INVENTION

This invention relates to a system for improving the Safety IntegrityLevel (SIL) rating in processes or operations that employ burners fed bya combustible gas or fuel line using partial stroke testing of anemergency shut-off valve coupled to a supplementary fuel control, i.e.,a second valve with a bypass for enabling the second valve to be fullyclosed for testing as a second emergency shut-off valve withoutinterrupting the process. Such systems are particularly applicable inthe oil, gas and petrochemical industries.

From the safety point of view, the shutoff action of the shutoff valveis of utmost importance in plant or factory operations or processes. Theoperability of the shutoff valve can be confirmed by means of the onlinevalve partial stroke testing. However, any failure in the internals ofthe shut-off valve may lead to a fuel leakage to the heater or othercomponent being supplied by the combustible gas or fuel passing throughthe valve(s). Introduction of a solenoid valve in the pneumatic circuitof the fuel control valve, in which the solenoid is driven by anemergency shut-off signal, is conceived as a means for supplementing thefuel shutoff action and the redundancy to achieve up to Safety IntegrityLevel Three (SIL-3) in plant or factory operations.

In addition, the partial stroke testing system in accordance with thepresent invention will not interfere with a plant trip, i.e., a fullshut down due to an emergency condition. Furthermore, if a partialstroke test is being conducted at the time of a plant trip, the partialstroke test will contribute to a more rapid closing of the emergencyshut-off valve. Thus, the partial stroking design acts as a backup tothe main trip mechanism.

Accordingly, such systems should reduce the cost of insurance or riskcoverage. In essence, the system partially closes the emergency shut-offvalve to a predetermined position to test and confirm its ability tofunction and to ensure its availability on demand in the event of aplant emergency.

The present system design can be applied to design loop instrumentation(e.g., heater or boiler fuel loops, to piping loops, or to anyseparation between high pressure loops and low pressure loops) toachieve up to the Safety Integrity Level Three (SIL-3) in the finalelement (shutoff valve) part by using a regulator control valve assupplementary or second shutoff valve, as required by IEC (InternationalElectrical and Electronic Commission)—61508 and ISA (Instrumentation,Systems, and Automation Society)S 84.01 standards.

TABLE 1 IEC 61598 Safety Integrity Levels Safety Integrity AverageProbability of Failure to Perform its Design Level Function on DemandSIL-1 >10⁻¹ to ≦10⁻² (One failure in 11 to 100 demands) SIL-2 >10⁻² to≦10⁻³ (One failure in 101 to 1000 demands) SIL-3 >10⁻³ to ≦10⁻⁴ (Onefailure in 1001 to 10,000 demands)

There is also a widespread concern among process operators about theProbability of Failure on Demand (PFD) of final shutdown elements, suchas shut-off valves used in safety applications. Partial trip testing ofthe final shut-off valve coupled with the supplementary emergencyshut-off valve according to the present invention will serve to improvethe PFD rating of shut-off action in such systems. In Table 2, the firstcolumn represents parameters of interest, where MTTF is the mean time tofailure, xv is the shut-off valve, cv is the control valve, Ti is thetest interval, and PITT is partial instrument trip testing. The secondcolumn is the test interval (in years), and the PFD in the third columnis the probability of failure on demand corresponding to the testinterval in the second column.

TABLE 2 Utilizing shut-off (XV) with the control valve (CV) in 1oo2configuration MTTF (xv) = 35 years Ti (CV) PFD MTTF (cv) = 35 years 0.51.09E−4 Ti (XV) = 4 years 1 1.14E−4 Ti (CV) = 0.5, 1, 2, 3 years 21.31E−4 Diagnostic Coverage (CV) = 85% 3 1.48E−4 Diagnostic Coverage(XV) = 80% T(PITT) = 1 week

A programmable logic scheme performs the function of controlling theactuation of the partial stroke of the shutoff valve system and theclosing of the shutoff valve and the control valve in the event of anemergency shut-off trip, to achieve up to Safety Integrity Level Three(SIL-3).

The system is designed for implementation on an emergency shut-offvalve, which is normally movable between a fully opened and a fullyclosed position, and a fuel control valve. The fuel control valveregulates pressure/flow to the burners or other component(s) using thegas, whereas the shut-off valve is normally in a fully open state. Theshut-off valve closes to cut off fuel supply in the event of anemergency.

As contemplated by the preferred embodiment of the invention, the fuelcontrol valve will be in a position between fully open and someregulated position and the emergency shut-off valve will be in its fullyopened position during normal operation of a process or operation. Bothvalves will rapidly close to shut down the process in the event of anemergency.

The system is designed for interfacing to the plant emergency shut-offsystem controller for generating electrical signals for initiating atest of the valves and to a source of pressurized gas such as compressedair for driving the valve shut-off system.

The essential control components of an emergency shut-off valve are themain trip solenoid valve with manual reset, quick exhaust valve and afluid actuator. The control components of the fuel control valve are asolenoid valve and a fluid signal from the I/P converter to the actuatorof the fuel control valve to accomplish the fuel regulating function.

On a trip signal the solenoid valve de-energizes, signaling the quickexhaust valve to vent the actuator and close the shut-off valve.

The invention provides a test means for testing the emergency shut-offvalve without fully closing the emergency shut-off valve in response toa signal from the plant emergency shut-off system controller.

The test means includes a second solenoid valve for bleeding offcompressed air to thereby move the emergency shut-off valve from a fullyopened position to a partially closed position. Means such as a closurelimit switch which may be operable on the basis of the movement of theshut-off valve, is provided.

Means such as a timer set to a predetermined time limit to terminate theshut-off valve test in the event of the limit switch failure is alsoprovided.

In addition, means for initiating cyclic or periodic testing andreporting of test results of the partial stroking of the emergencyshut-off valve is provided. During the partial stroke testing, thestatus of shutoff valves is displayed on the monitor of the DistributionControl System (DCS). Since the test loop is part of the distributioncontrol system, this provides the opportunity to observe any changes,detect trends, set alarms, and store this data in memory. This systemmay be used with any of the facilities and with any of the capabilitiesprovided by the emergency shut-down (ESD) and distribution controlcenter (DCS) available in the control room. Also, this system willindicate the positional change and movement of the valve and can berecorded and used for maintenance as a diagnostic tool. The record mayalso be used for insurance approval. Finally, if the test of the partialstroke of the valve is correct, it will return to the same trend asstored in control system memory.

These and other features of the present invention will become readilyapparent upon further review of the following specification anddrawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic illustration of a partial stroke testing of ashutoff valve coupled with supplementary shutoff of a fuel control valvein accordance with a preferred embodiment of the invention.

FIG. 2 is a flowchart that illustrates the operation of the partialstroke testing system software residing in the plant emergency shut-offsystem controller, in accordance with the present invention.

FIG. 3 is a flowchart that illustrates the operation of the softwareresiding in the plant emergency shut-off system controller, controllingthe partial stroking means in the event of an emergency trip signal fromthe plant emergency shut-off system controller in accordance with thepresent invention.

Similar reference characters denote corresponding features consistentlythroughout the attached drawings.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

It is well known in the oil, gas and petrochemical industries thatemergency shut-off valves are susceptible to a build-up of frictionalforces which if undetected can cause failure of the emergency shut-offvalve during an out of control process or operation. Accordingly, thevarious regulatory agencies concerned with the safety of such operationsmandate periodic shut-off valve testing and inspection in order toascertain shut-off valve operability.

As disclosed herein, a partial stroke valve test system tests anemergency shut-off valve on-line, i.e., without shutting down theprocess, for free movement over a reduced portion of its full stroke.Therefore, tests can be performed at frequent intervals. By so doing,there is a high probability of ensuring the emergency shut-off valve'soperability, which reduces the likelihood of failure of the emergencyshut-off valve during extended runs.

In the oil, gas and petrochemical industries, emergency shut-off valvesgenerally remain open while the operation or process is in a safe andcontrolled state. These valves close only upon a plant trip, i.e., theactuation of the emergency shutdown system of the factory or plant,which arises from an out of control process or operation. The emergencyshut-off valve typically includes a pneumatic cylinder that drives theemergency shut-off valve into a fully closed position within about onesecond.

The partial stroke testing system 10, incorporated with a shut-off valvefor use in the oil, gas, petrochemical and power industries, isillustrated schematically in FIG. 1. Such a system includes an emergencyshut-off valve 20 installed in series in a supply or delivery line 21for the combustible gas used for the process(es) or operation(s)accomplished in the factory or plant. The emergency shut-off valve 20remains in a fully open position during normal process conditions oroperations. Compressed air or other gas from a source 22, e.g.,conventional compressor or pressurized tank or container, etc., is usedfor maintaining the valve 20 in an open position. The compressed air orgas maintains the valve 20 in an open position by driving a springbiased piston actuator 24. The compressed air or gas flows through apneumatic line or tubing 23 through a main solenoid valve 26 and line 25to a quick exhaust valve 28, thence to the actuator 24 through the line27.

In the event of a plant trip, i.e., an out of control process oroperation, a signal as for example from the plant emergency shut-offsystem controller 30 actuates a solenoid 32 that closes the mainsolenoid valve 26 with respect to the pressurized air from the source 22and allows the air or gas from tubing or line 25 to exhaust through anexhaust port 26A. The release of pressure against the quick exhaustvalve 28 opens the exhaust port 28A allowing the actuator 24 to bleedthrough tubing 27, quick exhaust valve 28 and exhaust port 28A, therebyclosing the shut-off valve 20 to shut down the flow of combustion gasfor the process or operation of the plant or factory.

The partial stroke testing portion of the system 10 includes a secondsolenoid 40 and second solenoid valve 42. That portion also includes anisolation valve 44 that may be operated manually, as indicated by themanual control extending to the right of the isolation valve 44 inFIG. 1. The second solenoid valve 42 is operatively connected to theactuator 24 through pneumatic line or tubing 47, isolation valve 44,tubing or line 43 and “T” connection 45 through pneumatic line or tubing27.

A combination flow control and shut-off valve 57 is also installed inthe combustible gas supply line 21, in series with the previouslydiscussed emergency shut-off valve 20. The valve 57 is shown to thelower left portion of FIG. 1. A valve actuator 57A operates the valve57, controlling the valve 57 and thus regulates the flow of combustiblegas therethrough for the plant or factory operation. A trip event willalso actuate a third solenoid 69 (left portion of FIG. 1) by means of anelectrical signal 60 from the system controller 30, which opens solenoidvalve 68 to release the air pressure from the actuator 57A of thecontrol valve 57, causing it to close the valve 57 completely as anemergency shut-off. The trip event or electrical signal 70 (lowerportion of FIG. 1) from the emergency shut-off control 30 also actuatesa fourth solenoid 62, which opens solenoid valve 61 to bleed the gastrapped between the control valve 57 and the shutoff valve 20 if thereis any remote possibility of a leak from the control valve 57. Suchcombustible gas leakage (if any) is vented to the flare system 63, withthe system terminating in a gas combustion port at the top or distaloutlet end of the system 63 for any vented combustible gas. A manualreset 64 is provided to prevent an auto start before reset of thesystem, permitting operators of the system check it prior to restart.

Closure limit switch (ZSL) 77 and open limit switch (ZSH) 78 indicatethe opening and closing of the control valve 57. During the trip event,closure limit switch 77 will be on, i.e., electrically closed oractivated, and open limit switch 78 will be off, i.e., electrically openor inactive.

Isolation valves 59 and 66 provide isolation for solenoid valves 61 and68, respectively, for maintenance requirements. The valves 59 and 61 areconnected in series to the vent 63 and its distal gas combustion port tothe atmosphere.

Valves 75, 76, and 73 are components of the bypass system to be used forany required maintenance of the control valve actuator 57A and controlvalve 57 or during a full stroke test of the valve 57. The control valve57 also serves as a second emergency shut-off valve, as noted furtherabove.

Process control (PC) 71, current to pressure converter (FP) 74, andpressure transmitter (PT) 72 are part of the control process loop usedin the petrochemical and power plant industries.

A key feature of the present invention resides in the use of the controlvalve 57 as a second emergency shut-off valve. A bypass 571 extendsaround the valve 57 in order to enable this function. In practice, thecontrol valve 57 is provided in the combustible gas supply or deliveryline 21 and is in series with the first emergency shut-off valve 20. Thecontrol valve 57 can be isolated from the system by the bypass 571 forfully stroking the control valve 57 for testing or to allow the controlvalve 57 to act as a second emergency shut-off valve. Valves 73, 75 and76 are used to bypass the combination control valve and second emergencyshutoff valve 57 so that the second emergency shutoff valve 57 can befully stroked without shutting down the system. In such cases, the firstemergency shutoff valve 20 fully protects the system in the event of anemergency. However, when the first emergency shut-off valve 20 is beingtested, the control valve 57 serves as a second emergency shut-off valveto protect the plant or system in the event of a true emergency.

For a partial stroke test of the emergency shut-off valve 20, a signalfrom the plant emergency shut-off system controller 30 actuates thesecond solenoid 40, which opens the second solenoid valve 42 to bleedoff compressed air from the actuator 24 and associated pneumatic linesor tubes so that the spring biased actuator 24 partially closes the shutdown valve 20. This partial closing is limited by partial stroke limitswitch 52, which sends a signal to plant emergency shut-off systemcontroller 30 in a conventional manner. The plant emergency shut-offsystem controller 30 deactivates the solenoid 40 to thereby close thesecond solenoid valve 42 and the shut-off valve 20 returns to a fullyopen state. By limiting the movement of the shut down valve 20 by timeor stroke, there is no interruption of the flow of gas through thesupply or delivery line 21. Nevertheless the open limit switch 53 andpartial stroke limit switch 52 provide signals to the plant emergencyshut-off system controller 30 that the valve 20 actually moved, whichindicate that it is not frozen or stuck. Suitable sensing means such asa conventional linear variable transducer can also be used to check thatthe valve 20 has in fact been displaced in response to the signal fromthe plant emergency shut-off system controller 30. If the linearvariable transducer indicates that a preselected degree of deflectionhas occurred, the valve tested has been shown to be free to move.

However, if the sensing means indicates that the deflection has notoccurred, a signal is sent to the plant emergency shut-off systemcontroller 30 indicative of the fact. A suitable alarm is provided toindicate that the valve 20 is stuck and that corrective action should beinitiated.

The magnitude of the displacement of the valve 20 may be any suitabledegree to positively indicate that the valve movement is possible, butmust not be of such magnitude as to disrupt the process or the plantoperation and will ordinarily be accomplished in a few seconds or less.

The plant emergency shut-off system controller 30 may be interfaced to acomputer 54 to initiate periodic partial stroking of the shut-off valve20. The computer 54 is also used to record the results of each test,which may be printed out on a printer 56. The manually operatedisolation valve 44 is used to isolate the second solenoid valve 42 fromthe shut-off valve system for maintenance without affecting theoperation of the shut-off valve 20.

The manual latch facility 37 of the solenoid 32 of the main solenoidvalve 26 allows the operators to manually open the shut-off valve 20,after field verification, subsequent to a trip and reset of the tripsignal.

The control sequence for conducting the partial stroke test of the firstshut-off valve 20 (FIG. 1), programmed into the plant emergency shut-offsystem controller 30 (FIG. 1), is illustrated in FIG. 2. The PartialInstrument Trip Testing (PITT) or partial stroking of the shut-off valve20 is initiated by the plant emergency shut-off system controller 30(FIG. 1) by initiating the execution of the program sequence illustratedin FIG. 2. Starting at step 160 the plant emergency shut-off systemcontroller 30 (FIG. 1) energizes power supply to the solenoid 40(FIG. 1) of the solenoid valve 42 (FIG. 1) and starts an internal timeras indicated in step 161. On energizing the solenoid 40 (in FIG. 1), thesolenoid valve 42 (FIG. 1) opens and bleeds the actuator air supply,causing the actuator 24 (in FIG. 1) to move the shut-off valve 20(FIG. 1) towards the closed position.

The shut-off valve movement to partial limit is checked in step 164. Ifthe shut-off valve 20 (FIG. 1) has reached the partial limit, theprogram sequence proceeds to step 166 to de-energize the solenoid 40 (inFIG. 1) to close the solenoid valve 42 (FIG. 1) and to stop the timer.The actuator 24 (FIG. 1) on closure of the solenoid valve 42 (in FIG. 1)gets full air supply and drives the shut-off valve 20 (in FIG. 1) to itsfully open position. The program sequence then proceeds to step 168 toindicate the status of the test as pass and to step 170 for generating atest report and archiving the test data. After generating the testreport and archiving the test data (valve tag no., test status, testduration, and/or other data), the test control sequence is terminated atstep 172 and diverted to other applications in the plant emergencyshut-off system controller 30 (FIG. 1).

In the event that the shut-off valve 20 has not closed to its partiallimit in step 164 and the test timer (PITT timer) has not timed out asin step 171, the control sequence returns to step 162 and loops throughsteps 164 and 171 until the valve 20 reaches the partial limit or thePITT timer times out.

In the event that the shut-off valve 20 has not closed to its partiallimit in step 164 and the test timer (PITT timer) has timed out as instep 171, the control sequence goes to step 173 to de-energize thesolenoid 40 (FIG. 1) to close the solenoid valve 42 (FIG. 1). Theactuator 24 (FIG. 1) on closure of the solenoid valve 42 (FIG. 1) getsfull air supply and drives the shut-off valve 20 (FIG. 1) to its fullyopen position. The program sequence then proceeds to step 175 toindicate the status of the test as fail and to step 170 for generating atest report and archiving the test data. After generating the testreport and archiving the test data (valve tag no., test status, testduration, etc.), the test control sequence is terminated at step 172 anddiverted to other applications in the plant emergency shut-off systemcontroller 30 (FIG. 1).

The PITT solenoid valve 42 (FIG. 1) will remain energized, i.e., open,until the trip is reset. The additional bleed introduced by the solenoidvalve 42 (FIG. 1) will enhance the shut-off performance of the shut-offvalve 20.

A partial stroke testing system for on line testing of emergency shutoff valves can also be implemented as a portable self contained testapparatus for conducting partial stroke tests on shut off valves whichare controlled by non-programmable shut-off systems.

FIG. 3 of the drawings provides a flow chart that somewhat resemblesthat of FIG. 2. However, the flow chart of FIG. 3 encompasses theclosure of both the shut-off valve 20 and the control or regulatingvalve 57, as would occur in a complete system shutdown. Following theinitial start point 300 in FIG. 3, the three solenoid valves mostcritical to the operation of the shut-off valve 20 and the control orgas flow regulating valve, i.e., valves 26, 42, 68, and 61, areactuated, as indicated in the first step 302 of FIG. 3. This results inthe loss of pneumatic pressure to the main shut-off valve actuator 24 asthe main solenoid valve 26 closes, and the venting of pressure from thepressurized pneumatic line 27 to the actuator 24 as the PartialInstrument Trip Testing (PITT) valve 42 opens. The regulator solenoidvalve 68 also opens to release pneumatic pressure from the control orregulator valve actuator 57A, thus resulting in the closure of thecontrol or regulator valve 57. The vent solenoid 62 is also actuated toopen the vent solenoid valve 61, in order to vent any residual gasand/or gas leakage in the main gas supply line 21 between the shutdownvalve 20 and the control valve 57. The timer (included with the plantemergency shutdown system controller 30 of FIG. 1) is also started atthis point, as indicated in step 302 of FIG. 3.

The operation continues as indicated in the following step 304 of theflow chart of FIG. 3 until the main shutdown valve 20 and the control orregulator valve 57 are completely closed (step 306 of FIG. 3). If thevalves do not fully close within the period allotted by the timer, thesystem continues to attempt to close the valves, as indicated by theflow chart looping back from step 306 to step 304 in FIG. 3. Assumingthat the two valves 20 and 57 do close completely, thereby shutting downthe system, the stroke timer is stopped (step 308 of FIG. 3) and areport is generated (step 310 of FIG. 3). This terminates the shutdownprogram, as indicated by the final step 312 of FIG. 3.

Normally, the two solenoids 40 and 69 respectively for the main solenoidvalve 26 and the regulator solenoid valve 68 receive continuouselectrical power to hold the main solenoid valve 26 open and theregulator solenoid valve 68 closed. Cutting the electrical power tothese two solenoids 40 and 69 will result in a reversal of state fortheir two valves, with the main solenoid valve 26 closing and theregulator solenoid valve 68 opening. However, no electrical power isnormally supplied to the solenoids 40 and 62 respectively for thePartial Instrument Trip Testing (PITT) valve 42 and the vent solenoidvalve 61, with those valves normally remaining closed. Transmittal ofappropriate electrical power to actuate their two solenoids 40 and 62results in the opening of the two valves 42 and 61, thereby ventingpneumatic pressure from the shutdown valve actuator system and gaspressure from the combustion gas supply line 21 between the shutdownvalve 20 and the control or regulator valve 57 to the vent 63 and itsgas combustion port or flare. However, the system may be revised toobviate the need for electrical power to the two solenoids 40 and 69 andto require electrical power to the solenoids 40 and 62 for normaloperation, if so desired.

Analysis of the above-described system as illustrated in the schematicdrawing of FIG. 1 will demonstrate the redundancy of the valve systemand the reliability thus provided for the system. It is not necessaryfor all three of the system valves, 26, 42, and 68 to operate in orderto shut down the gas flow through the combustion gas delivery line 21.(As the vent or relief valve 61 does not actually control either theshutdown valve 20 or the combination control and shutdown valve 57directly, it is not included in the discussion of the redundancy andreliability of the system.) Rather, the operation (closure or opening,as appropriate) of any one of the main solenoid valve 26, PITT or secondsolenoid valve 42, and regulator or third solenoid valve 68 will resultin the closure of either the main shutdown valve 20 or the combinationcontrol (regulator) and shutdown valve 57. The table below illustratesthe redundancy and corresponding reliability of the system.

TABLE 3 System Reliability Shutdown Signal in Demand From EmergencyShutdown Controller System Valve 26 Valve 42 Valve 68 Shutdown Status 00 0 0 1 0 0 1 0 1 0 1 1 1 0 1 0 0 1 1 1 0 1 1 0 1 1 1 1 1 1 1

The above Table 3 illustrates the operation of the three valves 26, 42,and 68, and the resulting system shutdown when the valves operate. Thenumber “1” indicates valve operation in each of the valve columns andcorresponding system shutdown in the right hand “status” column. Thecharacter “0” indicates failure of valve operation and correspondingfailure of the system to shut down, with system shutdown failureoccurring only in the situation of the top row when all three valvesfail to operate.

As an example of the above, consider the second row of binarycharacters. In this row, the main shutoff solenoid valve 26 has operated(closed), as indicated by the 1 in the Valve 26 column. However, theremaining two valves, i.e., the Partial Instrument Trip Testing (PITT)valve 42 and the control or regulator solenoid valve 68 are shown to beinoperative, i.e., remaining closed as indicated by the 0 character intheir respective columns. In such a situation the control or regulatorvalve 57 would remain open, as the solenoid valve 68 controllingpneumatic pressure in this part of the system would remain closed, thusfailing to vent the control pressure for the actuator 57A. The actuator57A would thus continue to hold the control or regulator valve 57 opento allow gas flow therethrough. Also, the PITT valve 42 would notrelieve the pneumatic pressure to the actuator 24 of the shutdown valve20. However, the closure of the main solenoid valve 26 results in a lossof pneumatic pressure to the actuator 24, thus causing the actuator 24to close the shutdown valve 20.

It will be seen that similar scenarios occur when any one of the threevalves 26, 42, or 68 operate on demand to shut down the system, eventhough the other two valves fail to operate. This redundancy results inthe desired system shutdown in 2³−1 scenarios, or seven out of eightscenarios, as can be seen in Table 3. The reliability provided thusmeets or exceeds the standards required by Safety Integrity Level(SIL)-3, requiring no more than one failure in 1,001 to 10,000 demands.

In fact, the system reliability is even greater than that describedabove due to the operation of the vent control solenoid valve 61,serving to vent combustion gas from the portion of the gas delivery line21 between the shutdown valve 20 and the control or regulator valve 57.When the vent control solenoid valve 61 operates according to demand,combustible gas in the delivery line 21 is vented through the vent 63where it is discharged at the distal combustion port or flare of thevent line 63. While this per se is not sufficient to divert allcombustion gas from the delivery line 21 if both the shutdown valve 20and the control valve 57 remain open, the reduction of differentialcombustion gas pressure across the shutdown valve 20 relieves much ofthe stress on this valve, thus allowing it to operate more freely andmore reliably. In addition, the opening of the vent control solenoidvalve 61 serves to vent any combustion gas leakage past the control orregulator valve 57, in the event that this valve 57 has been signaled toclose but remains slightly open to allow some of the combustion gas topass therethrough. The venting of such residual combustion gas resultsin the control or regulator valve 57 serving as a supplementary orsecondary shutdown valve, as practically no combustion gas will continueto flow past the vent control solenoid valve 61 even when the shutdownvalve 20 remains open. Thus, it will be seen that the system of thepresent invention greatly enhances the reliability of gas deliverycontrol and emergency shutdown systems as installed in various plants,factories, and similar facilities.

It is to be understood that the present invention is not limited to theembodiments described above, but encompasses any and all embodimentswithin the scope of the following claims.

1. A partial stroke testing system coupled with fuel control valve,comprising: a combustion gas delivery line; a selectively operable gasshutoff valve disposed along the combustion gas delivery line; aselectively operable combination gas control and shutoff valve disposedalong the combustion gas delivery line, the combination gas control andshutoff valve being disposed in series with the gas shutoff valve; acontrol system for selectively automatically or manually substantiallycompletely closing and reopening the gas shutoff valve; a control systemfor selectively automatically or manually partially closing and openingthe gas shutoff valve; and a control system for selectivelyautomatically or manually substantially completely closing and reopeningthe combination gas control and shutoff valve.
 2. The partial stroketesting system according to claim 1, further comprising: a gas vent lineextending from the gas delivery line and between the gas shutoff valveand the combination gas control and shutoff valve, the gas vent linehaving a distal end; and a gas combustion port disposed at the distalend of the gas vent line.
 3. The partial stroke testing system accordingto claim 1, further comprising: a combustion gas bypass line disposed inparallel about the combination gas control and shutoff valve; and atleast one selectively openable and closable bypass line shutoff valvedisposed along the combustion gas bypass line.
 4. The partial stroketesting system according to claim 1, further comprising: a gas shutoffvalve actuator communicating pneumatically with the gas shutoff valve; apneumatic pressure line communicating pneumatically with the gas shutoffvalve actuator; a main solenoid valve disposed in the pneumatic pressureline, the main solenoid valve selectively controlling pneumatic pressureto the gas shutoff valve actuator; a pneumatic vent line communicatingpneumatically with the pneumatic pressure line; a second solenoid valvedisposed in the pneumatic vent line, the second solenoid valveselectively controlling pneumatic pressure in the pneumatic vent line; acombination gas control and shutoff valve actuator communicating withthe combination gas control and shutoff valve; and a third solenoidvalve communicating pneumatically with the combination gas control andshutoff valve actuator; wherein closure of any one of the main solenoidvalve, second solenoid valve, and third solenoid valve results inclosure of one of the gas shutoff valve and combination gas control andshutoff valve.
 5. The partial stroke testing system according to claim4, further comprising: an emergency shut-off system controllercommunicating electronically with the main solenoid valve, the secondsolenoid valve, and the third solenoid valve; a computer communicatingelectronically with the emergency shut-off system controller; and aprocess control communicating pneumatically with the combination gascontrol and shutoff valve actuator.
 6. The partial stroke testing systemaccording to claim 4, further comprising a current to pressure convertercommunicating pneumatically with the combination gas control and shutoffvalve actuator.
 7. The partial stroke testing system according to claim4, further comprising: a first open limit switch, a first closure limitswitch, and a partial stroke limit switch, each of the switchescommunicating with the gas shutoff valve and the emergency shut-offsystem controller; and a second open limit switch and a second closurelimit switch, each of the second limit switches communicating with thecombination gas control and shutoff valve and the emergency shut-offsystem controller.
 8. A partial stroke testing system coupled with fuelcontrol valve, comprising: a combustion gas delivery line; a selectivelyoperable gas shutoff valve disposed along the combustion gas deliveryline; a selectively operable combination gas control and shutoff valvedisposed along the combustion gas delivery line, the combination gascontrol and shutoff valve being disposed in series with the gas shutoffvalve; a control system for selectively automatically or manuallysubstantially completely closing and reopening the gas shutoff valve; acontrol system for selectively automatically or manually substantiallycompletely closing and reopening the combination gas control and shutoffvalve; a gas vent line extending from the gas delivery line and betweenthe gas shutoff valve and the combination gas control and shutoff valve,the gas vent line having a distal end; and a gas combustion portdisposed at the distal end of the gas vent line.
 9. The partial stroketesting system according to claim 8, further comprising a control systemfor selectively automatically or manually partially closing and openingthe gas shutoff valve.
 10. The partial stroke testing system accordingto claim 8, further comprising: a combustion gas bypass line disposed inparallel about the combination gas control and shutoff valve; and atleast one selectively openable and closable bypass line shutoff valvedisposed along the combustion gas bypass line.
 11. The partial stroketesting system according to claim 8, further comprising: a gas shutoffvalve actuator communicating pneumatically with the gas shutoff valve; apneumatic pressure line communicating pneumatically with the gas shutoffvalve actuator; a main solenoid valve disposed in the pneumatic pressureline, the main solenoid valve selectively controlling pneumatic pressureto the gas shutoff valve actuator; a pneumatic vent line communicatingpneumatically with the pneumatic pressure line; a second solenoid valvedisposed in the pneumatic vent line, the second solenoid valveselectively controlling pneumatic pressure in the pneumatic vent line; acombination gas control and shutoff valve actuator communicating withthe combination gas control and shutoff valve; and a third solenoidvalve communicating pneumatically with the combination gas control andshutoff valve actuator; wherein closure of any one of the main solenoidvalve, second solenoid valve, and third solenoid valve results inclosure of one of the gas shutoff valve and combination gas control andshutoff valve.
 12. The partial stroke testing system according to claim11, further comprising: an emergency shut-off system controllercommunicating electronically with the main solenoid valve, the secondsolenoid valve, and the third solenoid valve; a computer communicatingelectronically with the emergency shut-off system controller; and aprocess control communicating pneumatically with the combination gascontrol and shutoff valve actuator.
 13. The partial stroke testingsystem according to claim 11, further comprising a current to pressureconverter communicating pneumatically with the combination gas controland shutoff valve actuator.
 14. The partial stroke testing systemaccording to claim 11, further comprising: a first open limit switch, afirst closure limit switch, and a partial stroke limit switch, each ofthe switches communicating with the gas shutoff valve and the emergencyshut-off system controller; and a second open limit switch and a secondclosure limit switch, each of the second switches communicating with thecombination gas control and shutoff valve and the emergency shut-offsystem controller.
 15. A partial stroke testing system coupled with fuelcontrol valve, comprising: a combustion gas delivery line; a selectivelyoperable gas shutoff valve disposed along the combustion gas deliveryline; a selectively operable combination gas control and shutoff valvedisposed along the combustion gas delivery line, the combination gascontrol and shutoff valve being disposed in series with the gas shutoffvalve; a control system for selectively automatically or manuallysubstantially completely closing and reopening the gas shutoff valve; acontrol system for selectively automatically or manually substantiallycompletely closing and reopening the combination gas control and shutoffvalve; a combustion gas bypass line disposed in parallel about thecombination gas control and shutoff valve; and at least one selectivelyopenable and closable bypass line shutoff valve disposed along thecombustion gas bypass line.
 16. The partial stroke testing systemaccording to claim 15, further comprising a control system forselectively automatically or manually partially closing and opening thegas shutoff valve.
 17. The partial stroke testing system according toclaim 15, further comprising: a gas vent line extending from the gasdelivery line and between the gas shutoff valve and the combination gascontrol and shutoff valve, the gas vent line having a distal end; and agas combustion port disposed at the distal end of the gas vent line. 18.The partial stroke testing system according to claim 15, furthercomprising: a gas shutoff valve actuator communicating pneumaticallywith the gas shutoff valve; a pneumatic pressure line communicatingpneumatically with the gas shutoff valve actuator; a main solenoid valvedisposed in the pneumatic pressure line, the main solenoid valveselectively controlling pneumatic pressure to the gas shutoff valveactuator; a pneumatic vent line communicating pneumatically with thepneumatic pressure line; a second solenoid valve disposed in thepneumatic vent line, the second solenoid valve selectively controllingpneumatic pressure in the pneumatic vent line; a combination gas controland shutoff valve actuator communicating with the combination gascontrol and shutoff valve; and a third solenoid valve communicatingpneumatically with the combination gas control and shutoff valveactuator; wherein closure of any one of the main solenoid valve, secondsolenoid valve, and third solenoid valve results in closure of one ofthe gas shutoff valve and combination gas control and shutoff valve. 19.The partial stroke testing system according to claim 18, furthercomprising: an emergency shut-off system controller communicatingelectronically with the main solenoid valve, the second solenoid valve,and the third solenoid valve; a computer communicating electronicallywith the emergency shut-off system controller; a process controlcommunicating pneumatically with the combination gas control and shutoffvalve actuator; and a current-to-pressure converter communicatingpneumatically with the combination gas control and shutoff valveactuator.
 20. The partial stroke testing system according to claim 18,further comprising: a first open limit switch, a first closure limitswitch, and a partial stroke limit switch, each of the switchescommunicating with the gas shutoff valve and the emergency shut-offsystem controller; and a second open limit switch and a second closurelimit switch, each of the second switches communicating with thecombination gas control and shutoff valve and the emergency shut-offsystem controller.